CVE-2022-0267: AdRotate < 5.8.22 - Admin+ SQL Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-07 · updated 2026-06-17
Weakness: CWE-89

Description

The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection

Affected products

Adrotate Project Adrotate: before 5.8.22 — fixed in 5.8.22

How to fix

Upgrade to a fixed version: Adrotate Project Adrotate 5.8.22. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/7df70f49-547f-4bdb-bf9b-2e06f93488c6
https://wpscan.com/vulnerability/7df70f49-547f-4bdb-bf9b-2e06f93488c6

Get alerted when CVE-2022-0267 or the next vulnerability affects your stack